CVE-2026-17507

Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java versions prior to 1.86

Description The MLS implementation (org.bouncycastle.mls) incorrectly handles the leaf index (a uint32 value from RFC 9420) by storing it as a signed integer. When a wire value has the top bit set, it decodes to a negative number. Because the functions GroupKeySet.SecretTree.hasLeaf() and Group.validateRemove() use signed comparisons against the tree's leaf count, negative integers are treated as being less than the positive bound, allowing out-of-range senders to bypass membership checks. In the case of hasLeaf(), the SenderData of an unprotected PrivateMessage can trigger LeafIndex.directPath to perform NodeIndex.parent() arithmetic that fails to reach the tree root. This causes the resulting node list to grow indefinitely until the Java Virtual Machine (JVM) exhausts its heap memory, leading to a denial of service for all group members via a single small message.

Recommendations Update Bouncy Castle for Java to version 1.86 or later.